Pwned Labs

What Pwned Labs is

Pwned Labs is a hands-on cybersecurity training platform for cloud and AI security. Its About page says: "We train security professionals on real attacker tradecraft across cloud security, AI security, Kubernetes security, and CI/CD security." It serves individual practitioners, from beginners working through free labs to senior red teamers sitting expert exams, and security teams that need a tracked, measurable training program. The About page reports "over 40,000+ users", and the company operates as Pwned Labs Cybersecurity Training Services FZCO, with an address at Technohub, IFZA Business Park, Silicon Oasis, Dubai.

The model is summed up on the home page: "Build skills in the Academy, earn certifications in Bootcamps, and validate tradecraft in Cyber Ranges." The labs run in "Real cloud environments, not simulations", according to the bootcamps FAQ: "Practitioners work in actual AWS, Azure, GCP, and Microsoft 365 tenants to practice attack and defense techniques in realistic enterprise configurations."

The Academy and its labs

The Academy is the self-paced part. It offers "Guided labs for red and blue that walk you through real scenarios", and each lab "provides advice on what to log, what to alert on, and what to change to stop it." Learners need no cloud account of their own: "Labs run in live environments that Pwned Labs provides and you reach them through the browser."

The coverage is wide for a specialist platform. Per the FAQ, labs cover "AWS, Microsoft Azure and Microsoft 365, Google Cloud and Google Workspace, Oracle Cloud Infrastructure, Kubernetes, CI/CD pipelines and hybrid environments", and AI coverage "includes prompt injection against chatbots, agents and tool calls." The home page groups the skills into four areas:

• Offensive tradecraft: end-to-end attack chains across cloud, hybrid and SaaS, phishing and initial access for real cloud tenants, and C2 and persistence in cloud-native workloads.
• Defensive tradecraft: the telemetry to collect at each step, detections mapped to all stages of the cloud kill chain, and hardening advice tied to control gaps.
• AI and agent attacks: prompt injection, abuse of CI/CD automations and pipeline credentials, and data exfiltration through copilots and SaaS connectors.
• Hybrid attacks: on-prem Active Directory to cloud pivots, credential theft and lateral movement, and attack paths across endpoints, servers and cloud control planes.

That CI/CD, pipeline and infrastructure material makes the platform relevant to DevOps and platform engineers as well as security staff. One of the bootcamp instructors has also built a course on using Infrastructure as Code to build secure infrastructure on AWS.

Cyber ranges

The SkyFall Enterprise Cyber Range collection offers "Immersive, production-like cloud and hybrid environments." StormShadow and PhantomWave cover offensive tradecraft. PromptStorm is a blue team range in which defenders "Respond to a multi-stage AWS breach targeting AI and LLM infrastructure", with searchable logs, prebuilt dashboards and objectives that run from triage and scoping to containment, recovery and post-incident hardening. Customized SkyFall scenarios are available on request.

Bootcamps and certifications

Bootcamps are "Instructor-led bootcamps that culminate in certifications." The menu lists six: Amazon Cloud, Google Cloud, Microsoft Cloud, AI Systems and Kubernetes Attack and Defense in Professional Edition, plus a Microsoft Cloud Expert Edition. Each pairs attack techniques from named real campaigns with the defender workflow for catching them. The Microsoft bootcamp draws on intrusions such as Storm-0558 and APT-29 across Entra ID, Microsoft 365 and Azure; the AWS bootcamp on AMBERSQUID and SCARLETEEL; the Google Cloud bootcamp on TRIPLESTRENGTH; and the Kubernetes bootcamp on TeamTNT and the RBAC Buster operation, on clusters "from minikube to managed Kubernetes on AWS, Azure, and Google Cloud." The AI Systems bootcamp covers LLM applications, RAG pipelines and agentic systems.

The AI Systems and Kubernetes bootcamps are new: each "Launches 20 October" with "Early bird pricing: $349 until launch, then $399." The Expert Edition is "Self-paced, on-demand", available from June 2026, with preferential pricing for MCRTP alumni and existing enterprise customers. The bootcamps FAQ says: "All bootcamp enrollments include lifetime access to recordings, training materials, and lab environments so you can revisit and practice as often as needed."

The certifications are Pwned Labs' own. A bootcamp ends in "a fully hands-on practical exam" that is "scenario-based and designed to measure applied tradecraft, not memorization." The credentials are ACRTP for AWS, MCRTP for Azure and Microsoft 365, GCRTP for Google Cloud and Google Workspace, AISRTP for AI systems, KRTP for Kubernetes, a Cloud Penetration Testing certification, and MCRTE at expert level. Completing ACRTP, MCRTP and GCRTP earns M-CRTP3, the Multi-Cloud Red Team Professional. The bootcamps page says each credential "is verifiable", and the About page calls them "industry-recognized certifications". The footer notes that the programs are "not sponsored by, authorized by, or otherwise affiliated with Amazon, Microsoft, Google".

Pricing

The Academy has a free tier: "you can start working through labs without paying." Paid plans and bootcamps add the premium labs, cyber ranges and certification paths. The partner page publishes list prices: "Enterprise subscriptions start at $1,500 per user per year and Teams at $600. Bootcamps list at $399 for the Professional editions, $999 for the Multi-Cloud Red Team Professional certification and $2,500 for MCRTE, the Microsoft Cloud Red Team Expert." Two-day workshops are quoted per engagement. The About page mentions sponsored bootcamp places for women in cybersecurity and lifetime discounts for active service members and veterans.

For teams

The business offer gives a team "role-based cloud security labs and cyber ranges designed for business use", with analytics "to track adoption, identify skill gaps by role, and measure progress over time" and playlists so training "maps to what your organization actually needs." Every lab, range and scenario is mapped to MITRE ATT&CK, giving "technique-level coverage across the ATT&CK matrix, tracked per team and per operator." The outcome the page promises is "a tracked skills record for every engineer across AWS, Azure, GCP, Kubernetes, and CI/CD."

Beyond the platform, teams can book remote or on-site red, blue and purple team workshops, hybrid tabletop and crisis simulation exercises that end in an after-action report, and CTF events, which the partner page says can be hosted for up to 70 people. When a company wants an outside team, Pwned Labs practitioners run cloud penetration tests and security assessments across AWS, Azure, GCP and hybrid environments.

Resellers buy at list price less a margin. The partner page says: "Margins start at 25% on registered deals and rise with your annual volume across three tiers," and "any single registered deal of $45,000 or more at list price earns the top tier on that order." There is no minimum commitment, deal registrations are answered within 10 business days, and delivery stays Pwned Labs branded: the program "is not train-the-trainer or white-label."

Instructors and community

CEO Ian Austin, per the bootcamps page, has "a career spanning over 20 years in technical, security and leadership roles." CTO Sheeraz Ali is a speaker at Nullcon and c0c0n and a "Holder of 21 CVEs". The community runs on a 10,000+ member Discord, and resources include a Cloud Security Engineer Roadmap, a Security A-Z, video walkthroughs, the PwnCloudOS environment, events and a content creator rewards scheme. Testimonials come from consultants at NetSPI, Bishop Fox, Pen Test Partners and Centene; a senior penetration tester at Centene writes that "the ACRTP and MCRTP bootcamps gave me a solid foundation in AWS and Azure offensive security."

Who it suits and who it does not

Pwned Labs suits security practitioners moving into cloud work, pentesters who need AWS, Azure or GCP depth, blue teamers who want detections for cloud attacks, and engineers responsible for Kubernetes and CI/CD. The free Academy tier lets anyone try the format first. Security managers get a tracked skills record, ATT&CK coverage maps and ranges, with services on top.

The focus is cloud, AI and hybrid security. Someone who needs general IT basics or web application testing will want a broader platform, and the bootcamps FAQ says the professional and expert bootcamps "are designed for practitioners with foundational cloud or security knowledge."